ID. Date of interview 
date 96/02/20 


ID. Time interview started 
start 15:38:38 


ID.end Completion date of interview 
Date = 06/02/20 


ID.end Time interview ended 
15:51:28 


ID. Duration of interview 
time 1283 


new case 


ICO consultation on the draft right of access 
guidance 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 
O) Yes 
© No 
©) Unsure / don't know 


If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


It would be helpful to have further detail around the pause / stop the clock function for ID/Consent. You 
have dealt with the matter of clarifying content of the SAR and not pausing well but we feel further detail 
around when to stop the clock in the above situation would lead to correct counting and tracking of 
processing time frames at both individual SAR and Organisational level. 


Q3 


Does the draft guidance contain enough examples? 
-) Yes 


© No 


©) Unsure / don't know 


If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


We welcome the examples around counting the calendar month, particularly short months and if the end 
of month falls on a bank holiday and weekend. It would be very helpful if we could have similar examples 
to cover the start / stop of the clock when we have to request ID/Consent from requesters. Best practice 
is followed and staff Standard Operating Procedures and Training advise staff processing such requests 
to acknowledge the request and ask for missing |D/Consent within 48 hours and this happens in the 
majority of cases. Occasionally, circumstances may change whilst processing a SAR and consent may 
no longer be valid, particularly for mental health patients, and part way through the month staff need to 
request ID/Consent. It would be helpful if this type of scenario were covered as an example of how to 
calculate the calendar month date as presently we have read the new guidance to indicate we count the 
calendar month from the later date at which we request the information around consent / ID. Currently we 
have interpreted guidance to indicate we should stop the clock only for the period that we are awaiting the 
ID/Consent from the requester so for example, if we were waiting for 7 days the calendar month date 
would move on by 7 days. Clarity would be helpful. 


Q4 


We have found that data protection professionals often struggle with applying and defining ‘manifestly 
unfounded or excessive’ subject access requests. We would like to include a wide range of examples 


from a variety of sectors to help you. Please provide some examples of manifestly unfounded and 
excessive 


requests below (if applicable). 


It would be helpful if you could provide more advice around complex requests to avoid confusion 
around this. We do receive a small number of SAR's relating to employees requesting copies of emails 
containing their personal data. It would be helpful if we could receive guidance on how to undertake 
this information gathering and screening to ensure equity and consistency. 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


1-Notatall 2-Slightly Moderately 4-—Very 5-Extremely 
useful useful useful useful useful 


O O O © O 


Q6 Why have you given this score? 


The examples are very helpful as is documenting the relevant parts of the GDPR that 
apply as this helps with understanding of this new legislation. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


© 


Q8 


Q9 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


It would be helpful to include something about the impact of leaving the EU and 
whether any local amendments to GDPR are planned going forward for the UK. 


Are you answering as: 

O An individual acting in a private capacity (eg someone providing their views as a member of the public) 
© An individual acting in a professional capacity 

C) On behalf of an organisation 

() Other 

Please specify the name of your organisation: 

Worcestershire Health and Care NHS Trust 

What sector are you from: 

Medical records Company Secretary Office 


Q10 How did you find out about this survey? 
©) ICO Twitter account 
(_ ) ICO Facebook account 
(_) ICO LinkedIn account 
C) ICO website 
©) ICO newsletter 
( ) ICO staff member 
(_) Colleague 
(_) Personal/work Twitter account 
(_) Personal/work Facebook account 
(_) Personal/work LinkedIn account 
(_) Other 
If other please specify: 


